Doesn't that mean the folks are failing at handling password resets on their own? It's a failure of the self service, not that the questions aren't visible to admins or anything like that.
The user should be setting the question/answer the first time they log in. If you cannot remember your father's middle name, etc., then I think you have bigger problems than just forgetting your password...
Did you guys choose some other sort of reminder questions, things that maybe aren't as static as father's middle name?
So here's the thing. I call the client's call center and pretend to be you. "Sorry, I don't remember what I put in for my father's middle name" I tell them, so the admin does what, looks it up and then gives it to me? Or does he just go ahead and resets your password to whatever I tell him to use? That's great, because now I've just taken over your account and can do with it whatever I like.
The kind of thing you want to do is kind of how security breaches happen...
